IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF NEW HAMPSHIRE 


IN THE MATTER OF THE SEARCH OF 
THE RESIDENCE LOCATED AT 103 S 

LINCOLN ST, APT 1, KEENE, NH, AND A | Filed Under Seal 
BLACK, FORD TAURUS [NH 3386505] 


Case No. 20-mj-31-01-AJ 








AFFIDAVIT IN SUPPORT OF APPLICATIONS FOR 
SEARCH WARRANTS 


I, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION 


2. I am a federal law enforcement officer of the United States within the meaning of 
Federal Rule of Criminal Procedure 41(a)(2)(C), duly authorized to conduct investigations of and 
make arrests for violations of United States Code. 

3. The probable cause set forth in this affidavit is based upon my personal 
knowledge and observations, experience and training, as well as through information derived 
from investigators of the Keene, NH Police Department (PD), the Manchester, NH PD, NH State 
Police, multiple FBI Offices, cooperating individuals, database queries, extensive review of open 
source information, as well as physical and electronic surveillance, and other methods. 

4. Since the affidavit is being submitted for the limited purpose of establishing that 
probable cause exists to support the issuance of a search warrant, I have not included details 
about every aspect of the investigation. While this affidavit contains all the material information 
I am aware of that is pertinent to the requested search warrants, it does not set forth all of my 
knowledge about this matter. 

5. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that Christopher Cantwell transmitted extortionate and 
threatening communications in violation of Title 18 U.S.C. § 875. There is also probable cause 
to search the locations described in Attachments A-1 and A-2 for evidence of these crimes, as 


described in Attachments B-1 and B-2. 


PROBABLE CAUSE 


Background 
6. Christopher Cantwell (“Cantwell”) resides at 103 South Lincoln St in Keene, NH. 
He has an active NH driver’s license reflecting the same address. A black, 2013 Ford Taurus 


bearing NH license plate 3386505 is registered in Cantwell’s name at the same address as well. 


T: Cantwell has a criminal history that includes misdemeanor convictions for 
criminal trespass, criminal possession of stolen property, criminal possession of a firearm / 
weapon, negligent driving, and public intoxication, as well as multiple convictions for speeding 
and driving while intoxicated. Cantwell has not been convicted of a felony. Cantwell was also 
charged with Dangerous Gas: Malicious Release Cause Injury and Assault: Unlawful Injury by 
Acid/Explosive/Fire for actions committed in Charlottesville, Va. in 2017, but eventually 


pleaded guilty to misdemeanor Assault & Battery and was banned from the state of Virginia for 


five years. 
Investigation 
8. Christopher Charles Cantwell is an openly self-proclaimed Neo-Nazi and member 


of the Alt-Right Movement. He gained notoriety for his involvement as a participant and 
featured speaker during the Unite the Right rally in Charlottesville, VA in August 2017. 
Afterwards, Cantwell was featured prominently in two HBO Vice News Tonight documentaries 
about the rally, its participants, and the aftermath. Cantwell received considerable public 
attention for a video he uploaded shortly after the rally in which he wept while sharing 
knowledge of a warrant for his arrest. Cantwell has since been widely referred to and ridiculed 
as "The Crying Nazi." 

9, Cantwell has previously run multiple websites and hosted multiple podcasts / 
webcast shows focused on white nationalism. He became well known to many supporters as 
well as many with opposing views. Among those previously claiming to be like-minded was a 
group of individuals known by various online pseudonyms, collectively referred to as the “Bowl 


Patrol”, who became online associates of Cantwell in late 2017 or early 2018. 


10. Cantwell previously conveyed to the FBI that members of the Bowl Patrol 
reached out to him while he was incarcerated in Virginia following the Charlottesville event. 
Various members showed him support and sought guidance in establishing an online platform. 
Cantwell embraced the alliance and at some point even provided access credentials for some of 
his websites or accounts to select members, including the group’s leader, an online user known 
as “Vic Mackey”. Bowl Patrol members openly admire Dylann Roof, who was convicted of 
federal hate crimes for killing nine people during a 2015 massacre at a historically black church 
in Charleston, SC. Roof subsequently became the first federal hate crime defendant to be 
sentenced to death. Roof became widely recognized by his distinct haircut, known as a 
“Bowlcut”, which has become synonymous with the Bowl Patrol and Roof in many online 
forums. 

11. Cantwell explained that he and the Bowl Patrol began to suffer a fandamental 
divide following the mass shooting at a Pittsburgh synagogue committed by Robert Bowers in 
October 2018. Cantwell claimed that since he did not offer the same support for the incident as 
the Bowl Patrol did, members began ridiculing and harassing him. The alleged harassment 
included website defacement and posts via fake online and social media accounts pretending to 
come from Cantwell. Multiple members of the Bowl Patrol, including “Mosin Nagant” and 
“Cheddar Mane,” admitted to prank-calling Cantwell’s “Radical Agenda” show. Cantwell also 
believed they were responsible for distributed denial-of-service (DDoS) attacks against his 
websites and for robo-calling his shows, congesting the phone lines with spoofed, un-attributable 
numbers. Cantwell warned Bowl Patrol members via various online forums to cease such 


activity and that he had reported the matter to law enforcement. 


12. In February 2019, Cantwell filed a sworn complaint stating that his website, 
ChristopherCantwell.com, was “defaced with terrorist propaganda and pornography” the 
previous night, including with “pro Robert Bowers material and bestiality.” Cantwell gave two 
IP addresses of the suspected culprits, and indicated that a “WordPress login” had occurred. He 
said the attack was carried out by members of the Bowl Patrol. He named Vic Mackey (the 
acknowledged leader of the Bowl Patrol) and Mosin Nagant as the offenders. According to 
Cantwell, “Vic had an author’s account on my website some time back when he was allowed to 
contribute content. His permission to do so had since been rescinded, but his account remained 
active.” Cantwell stated that the Bowl Patrol “has been responsible for constant spam and 
harassment of me and my communications channels for months, ever since I distanced myself 
from the group in the wake of the Pittsburgh synagogue shooting.” “I am interested in pursuing 
criminal charges if at all possible.” 

13. On or around March 5, 2019, Cantwell doxed, or released identifying information, 
for a Bowl Patrol member using the online alias “Mosin Nagant”. 

14. On 5/23/19, FBI personnel observed a black, plastic Otterbox container, as 
depicted in Attachment A-2, affixed beneath the trunk area, to the underside exterior of the black 
Ford Taurus bearing license plate [NH 3386505], registered to and operated by Cantwell, while it 
was parked in a public area. Cantwell has been observed by FBI personnel on multiple other 
occasions, both before and after this instance, accessing or emplacing the same, or others similar 
to, black plastic container in the same vicinity beneath the rear trunk area of his vehicle. Such 
activity occurred as recently as 1/19/20. Based on my experience, such a container, while 
compact, is of sufficient size to conceal digital storage media, narcotics, small weapons or other 


sensitive items. 


15. 


On or around July 11, 2019, FBI personnel became aware of an extortion threat 


made by Cantwell via the “Telegram” secure social messaging platform. In the exchange, which 


occurred on June 15-16, 2019, Cantwell threatened to rape the wife of another individual. The 


individual, known by the online alias as “Cheddar Mane”, aka “Cheddar Man” (“CM”), is a 


known member of Bowl Patrol. As part of the extortion threat, Cantwell (CC) threatened to 


harm CM’s family unless he provided identifying information for the Bowl Patrol’s known 


leader, “Vic Mackey”. Screen captures of the exchange were obtained from open sources, as 


shown below: 


June 15, 2019 





CC: I guess you forgot the lesson which kept you away for a short while. Do 
you need to be reminded? 


[CM’s HOME ADDRESS] 

CM: What are you talking about 
Some fag pretends to be you 

What do you even stand to gain here 


Let’s think about this. Every time someone you think is in BP talks shit about 
you — a public figure — you threaten to dox me? Say you did. What then? 


I honestly don’t know what I even did. 
I followed a link into a group I didn’t even know you were in. 


June 16, 2019 





CC: Geta fucking life or I will ruin the one you have. 
Don’t bother anyone, then you won’t have to worry about crossing me. 


CM: Ihaven’t given you any thought and it was an honest mistake. Didn’t 
even know you were in there or I’d have thought better of it. Other than that, all I 
can do is just leave you the fuck alone and tell other people to do the same — 
which I have done. 


Seriously man I couldn’t care less about what you are trying to do these days. 


CC: _ You're a fucking liar. You came here with your loser fucking pals 
because you have the attention span of a nigger and the morals of a kike, and 
because of that fact, you are going to lose everything you have 


Next time I post that photo, the faces won’t be blurred, and then you’re going to 
start getting unexpected visitors 


And I don’t care if it’s you causing the trouble, you’re the one who’s gonna suffer 
cause you’re the one who I can get 


If you wanna dox Vic, he’s a better target, but if you give me fake info, then your 
wife is gonna have trouble sleeping at night until she leaves you and takes your 
kids away 


CM: What picture are you even talking snout 
About 
CC: Fuck around and I’Il remind you the hard way 


CM: So lam assuming peach took the picture. Guess that means you don’t 
care what happens to her either 


CC: Asa matter of fact, I don’t. So if you don’t want me to come and fuck 
your wife in front of your kids, then you should make yourself scarce 


Give me Vic, it’s your only out 

I guess I’m going to have to prove my seriousness 

CM: Show me the picture you have 

CC: No 

[PHOTO OF CM’s WIFE & CHILDREN] 

More where that came from. 

I bet one of my incel listeners would love to give her another baby. 
You think the FBI would take issue with an LSD user owning guns around kids? 
[PHOTO OF CM WITH STRIPS ON TONGUE] 

Give me Vic 

CM: I don’t own guns or do drugs 

CC: Lol 

OK I guess you're not going to give me what I want 


Fine. Good luck 


CM: I don’t even have his dox 
CC: Guess you're fucked then 


Alright, since you’re obviously not understanding the severity of this, P11 do you 
a favor. 


On Tuesday I’m going to send every episode of BowlCast along with your 
identifying information to whatever the local equivalent of CPS is in your 
jurisdiction. 


This way the information won’t be public, yet. 


On Tuesday you should be able to talk to your wife and kids and get them to all 
have their stories straight. get anything incriminating out of the house. 


But I’m pretty sure once that visit comes, you’ll understand that this is serious. 
If that doesn’t work, Ill escalate until I get what I want. 
Tell Vic that if he gives himself up, he can save your family 


He won’t do it, but at least then you’ ll know for certain that you chose the wrong 
side 


CM: Lol you’re such a fucking nobody Chris. Do your worst you crazy junkie 
loser. Go boof some meth up your asshole you faggot ass kike 


16. On 7/17/19, Cantwell emailed the FBI in Bedford, NH, regarding harassment 
from the “Bowl Patrol.” He claimed to have been victimized via his websites, servers, and 
phone services used in support of his podcast shows, Radical Agenda and Outlaw Conservative. 
Previous attempts were made by FBI personnel to discuss the matter via telephone and in person, 
but Cantwell insisted on recording any such conversations. Cantwell instead elected to continue 
to communicate with the FBI via email, so he could create records of all proceedings. Over the 
following months, Cantwell emailed the FBI dozens of times, providing voluminous information, 
which he claimed supported the harassment allegations. 

17. On 8/28/19, Cantwell provided to the FBI unmasked, digital images of CM’s 
family and “Cheddar Man” himself. The images were the same images shared during the 


message exchange between Cantwell and CM on 6/15/19 — 6/16/19. Cantwell also provided a 


screen capture displaying the home address of “Cheddar Man”, which was also provided during 
the same referenced message exchange. 

18. On 9/17/19, Cantwell was interviewed by FBI personnel. Cantwell explained that 
he had asked “Cheddar” for “Mackey's” info and threatened to dox him and call Child Protective 
Services (CPS) if he did not provide it. (CM and his wife live in a different state and are the 
parents of three small children.) According to Cantwell, other individuals claimed to Cantwell 
that this was extortion. Cantwell stated, “I believe you are already aware of this exchange” and 
“T don't think I need to say anything else about that, but I guess I just did.” At the time he 
confronted “Cheddar”, Cantwell felt he did not have protection from law enforcement and that 
he had to take action himself. Cantwell indicated that after the corresponding exchange with 
“Cheddar”, he deleted the chat and called CPS the next day. 

19. | Cantwell also provided the name and phone number of another supposed victim 
of harassment from the Bowl Patrol, who also could corroborate his complaint. KF was a former 
romantic interest of Cantwell who provided Cantwell with the home address and family photos 
of “Cheddar Man”. KF was a former associate of multiple Bowl Patrol members, including 
“Cheddar Man” and “Hardmaus”. KF was known by the online moniker, “Peach”. Cantwell 
advised FBI personnel that KF was aware of his communications with the FBI, and that she 
would be willing to speak with investigators to substantiate Cantwell’s claims. 

20. During the same interview, Cantwell told investigators he retained some screen 
shots concerning “Mosin Nagant” from Gab. Cantwell subsequently emailed related digital 
images to the FBI on 9/18/19. Cantwell also described PN, aka “UnclePaul1488”, as a well- 
known affiliate of Bowl Patrol who was often referred to online as “Uncle Paul”. Cantwell 


retained email records of Telegram abuse he reported which included PN's email address. 


According to Cantwell, PN had his own Telegram Channel which he used to egg on the Bowl 
Patrol and other would-be violent actors. 

21. Late on 10/8/19, Cantwell was observed by FBI personnel in Maryland walking 
back and forth from the residence he often shared with his known girlfriend, ID, and his Ford 
Taurus. Cantwell and ID were known to stay together at a residence located at 

Arnold, MD. At the time, Cantwell was observed multiple times carrying many items, 
including a black box, multiple bags and backpacks, a possible PC, a computer tower, a suitcase, 
a large white plastic bag, and other miscellaneous items. Cantwell subsequently departed 
Maryland and returned to New Hampshire with the previously listed items. 

22. In October 2019, “Cheddar Mane” (CM) and his wife were interviewed by FBI 
personnel. Both said that they took Cantwell’s threat seriously and were afraid for their family’s 
safety. CM verified that the threatening communication occurred during a message exchange via 
the Telegram application. CM reiterated he took the threat very seriously, and he had taken 
measures to protect his family. He deleted his Telegram account following the threat and 
removed his Facebook account. He also attempted to remove his personal data from a number of 
websites. CM was typically armed and usually had a gun within reach. He also purchased a 
camera to see who came and left his driveway. CM also indicated he had retained screen shots 
of the threatening message exchange with Cantwell for his own records, and that after the threats 
he had circulated screen shots of the threats on-line. 

23. On 10/24/19, Cantwell was interviewed again by FBI personnel and was shown 
an email he previously sent to the FBI. The email contained a paragraph that begins with, “The 
CPS thing was a guy who goes by the name of Cheddar Mane.”, as well as other excerpts 


including, “I threatened to expose his identify if he continued harassing and defaming me.” and 


Page 11 redacted for the following reason: 


“Hardmaus” and that’s how he got the information for “Cheddar Man”. Throughout the call KF 
expressed her reluctance to cooperate with law enforcement, even in order to corroborate 
harassment claims by Cantwell against members of Bowl Patrol. 

26. On 1/6/20, Cantwell returned from a brief stay in Maryland to his known 
residence in Keene, NH, as observed by FBI personnel. The following morning, he was 
observed unloading his vehicle taking multiple items into the residence. Items removed from 
Cantwell’s vehicle included tripods, at least one computer, monitors, a keyboard box, garments, 
a printer, a projector or fan, a toolbox, a drill, a camera bag, backpacks, duffel bags, a black 
storage bin, and Amazon and USPS priority cardboard boxes. 

27. Previous open source research revealed an Amazon.com Wish List for Chris 
Cantwell. The list featured a photo of Cantwell recognizable from the previously referenced, 
original VICE News documentary about Charlottesville. This wish list was observed to contain 
various forms of digital storage media such as portable hard drives and USB storage drives 
(thumb drives), as well as a wireless (Wi-Fi) router, recording equipment, and other 
miscellaneous items. Cantwell has referred to this list often during multiple episodes of his 
podcast / webcast shows, as he encourages followers to support him by purchasing items. 

28. Cantwell has posted numerous articles between his multiple websites regarding 
privacy, tradecraft, and operational security (OPSEC). He emphasizes use of the Dark Web and 
TOR (The Onion Router), virtual private networks (VPNs), secure email, secure operating 
systems, Russia-based software, encrypted communication applications, tax avoidance, and use 
of cryptocurrency. Cantwell has also posted information on tracking and search tools used both 
to aid in online anonymity as well as to research sensitive, personal information about 


adversaries in order to “dox” them, or broadcast their private or identifiable information online. 


29. Cantwell has typed recent statements to law enforcement further demonstrating 
habits of creating digital records and archiving digital information as well as acknowledgement 
of potential wrongdoings: 

“T'd be interested in providing you with a USB drive containing video and other 
information from my legal problems in the Commonwealth of Virginia... I'd be 
shocked to find such doubts did not exist within the KPD, given some of the 
ridiculous things that I’ve said and done over the years.” 

“T'm typically in compliance with the law.” 

30. Investigative research has not revealed any physical location of employment for 
Cantwell. In addition, he has not been observed traveling to or from any known work location 
with any adherence to a regular schedule. All accounts provided by Cantwell indicate he is self- 
employed and relies on donations and financial support from others. Cantwell is also believed to 
record his online podcasts / webcast shows from his residence. This includes periods of time in 
2019 when Cantwell stayed in Maryland with his known girlfriend, and indicated at the 
beginning of his regular shows that he was recording in Maryland. 

31. During the course of this investigation, no other vehicles of similar resemblance 
to the black Ford Taurus [NH 3386505] have been observed at or in the vicinity of 103 S Lincoln 
St in Keene, NH, the location of Cantwell’s known residence. Cantwell was the only individual 
observed accessing or driving [NH 3386505] during the same timeframe. 

32. Based on my training and experience as a federal law enforcement agent and as a 
previous digital forensic examiner, as well as that of many colleagues involved in this 
investigation, combined with the totality of the circumstances and extensive evidence revealed 


during the course of this investigation, there is probable cause to believe Christopher Cantwell 


has been involved in making threats of violence via interstate communications. Probable cause 
also exists to believe Cantwell has attempted to undermine and manipulate efforts by law 
enforcement to detect or prevent related criminal activity, as demonstrated by his limited 
cooperation with federal law enforcement, which occurred only after he transmitted threatening 
communications to his victims, and after he was told by others he may have criminal culpability 
as aresult. Cantwell also indicated he kept minimal records of direct communications with 
members of Bowl Patrol, although he has demonstrated routine desire to record phone 
conversations and to thoroughly document other activities. Cantwell also has demonstrated 
significant acumen and advanced knowledge of tactics and techniques to avoid detection by law 
enforcement in order to hide his true actions and any potential co-conspirators. Recently, 
Cantwell has also been observed physically relocating computer equipment between multiple 
states, which potentially contains evidence of the aforementioned violations. Research indicates 
the Telegram messaging application can be used on a variety of platforms including mobile 
phones, as well as directly from web browsers on desktop or laptop computers. Accordingly, 
probable cause exists that Cantwell transmitted, or stored records of, threatening 
communications via a combination of devices. Moreover, the combination of these facts also 
supports the existence of probable cause that Cantwell has previously and continues to use 


hidden containers as depicted in Attachment A-2 to conceal potential evidence. 


CONCLUSION 
33. Based on the aforementioned related facts, I submit that this Affidavit supports 
probable cause for a warrant to search the residence located at 103 S Lincoln St, Apt 1, Keene, 
NH, and the black Ford Taurus [NH 3386505], as described in Attachments A-1 and A-2, 


respectively, and to seize items described in Attachments B-1 and B-2, believed to be evidence 


of the offenses committed by Cantwell. 
34, I hereby swear under oath that the information set forth in this Affidavit is true 


and correct to the best of my knowledge, information, and belief. 


Subscribed and sworn to before me on January 21, 2020, at Concord, New Hampshire. 


/s/ Andrea K. Johnstone 





Honorable Andrea K. Johnstone 
United States Magistrate Judge 
District of New Hampshire 


ATTACHMENT A-1 
Property to Be Searched 

The property to be searched is 103 S Lincoln St, Apt 1, Keene, NH 03431, identified as 
the residence of Christopher Cantwell. The primary structure is a two-story, off white, multi-unit 
building with no shutters and a dark roof, as well as a side driveway and parking area accessible 
from S Lincoln St. Christopher Cantwell’s residence is known to be Apt 1, which encompasses 
the entire first floor of the structure. The residence is accessed by an exterior door accessible 
from the porch on the driveway side of the house. The driveway is accessible from S Lincoln St, 
immediately across the street from the playground of the Monadnock Waldorf School. 

Also to be searched on the property is a common storage area in the basement which is 


accessible by all tenants, including Cantwell. 
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ATTACHMENT A-2 
Property to Be Searched 
The property to be searched is a black Ford Taurus bearing license plate [NH 3386505]. 
The vehicle is registered to and typically operated by Christopher Cantwell. The vehicle is usually 
parked at Cantwell’s known residence, as described above, located at 103 S Lincoln St, Keene, 


NH. Cantwell has been observed to use hidden storage compartments in and around the vehicle 


as depicted below: 











ATTACHMENT B-1 
Particular Items to be Seized 


All records relating to violations of Section 875 of Title 18, those violations 


involving Christopher C. Cantwell and occurring after October 2018, including: 


above. 


Records and information relating to interstate threats or extortion against 


“Cheddar Mane,” CM’s family, or persons associated with the Bowl Patrol; 


Records and information relating to Cantwell’s communications with Child and 


Protective Services regarding Cheddar Mane and his family; 


Records and information, including photographs, relating to Cheddar Mane, his 


family, and his location and residence; 


Records and information relating to Cantwell’s disputes with and antipathy for 


Cheddar Man, Vic Mackay, and other members of the Bowl Patrol; 


Records and information relating to Cantwell’s use of and control over a 


Telegram messaging account; 


Records and information relating to the destruction of evidence of the crimes 


described above; and 


Records and information relating to the identity or location of Cantwell and the 


victim. 


Computers or storage media used as a means to commit the violations described 


3: For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 


information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 


a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 


logs, photographs, and correspondence; 


b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 


c. evidence ofthe lack of such malicious software; 


d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 


to crime under investigation and to the computer user; 


e. evidence indicating the computer user’s state of mind as it relates to the crime 


under investigation; 


f. evidence of the attachment to the COMPUTER of other storage devices or similar 


containers for electronic evidence; 


g. evidence of counter-forensic programs (and associated data) that are designed to 


eliminate data from the COMPUTER; 


h. evidence of the times the COMPUTER was used; 


i. passwords, encryption keys, and other access devices that may be necessary to 


access the COMPUTER; 


j. documentation and manuals that may be necessary to access the COMPUTER or 


to conduct a forensic examination of the COMPUTER; 


k. records of or information about Internet Protocol addresses used by the 


COMPUTER; 


l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 


records of user-typed web addresses; 


m. contextual information necessary to understand the evidence described in this 


attachment. 


4, Routers, modems, and network equipment used to connect computers to the 


Internet. 


As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 


that can store data); any handmade form (such as writing); any mechanical form (such as printing 


or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 


videotapes, motion pictures, or photocopies). 


The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 


network hardware. 


The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 


other magnetic or optical media. 


ATTACHMENT B-2 
Particular Items to be Seized 


All records relating to violations of Section 875 of Title 18, those violations 


involving Christopher C. Cantwell and occurring after October 2018, including: 


above. 


Records and information relating to interstate threats or extortion against 


“Cheddar Mane,” CM’s family, or persons associated with the Bowl Patrol; 


Records and information relating to Cantwell’s communications with Child and 


Protective Services regarding Cheddar Mane and his family; 


Records and information, including photographs, relating to Cheddar Mane, his 


family, and his location and residence; 


Records and information relating to Cantwell’s disputes with and antipathy for 


Cheddar Man, Vic Mackay, and other members of the Bowl Patrol; 


Records and information relating to Cantwell’s use of and control over a 


Telegram messaging account; 


Records and information relating to the destruction of evidence of the crimes 


described above; and 


Records and information relating to the identity or location of Cantwell and the 


victim. 


Computers or storage media used as a means to commit the violations described 


3: For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 


information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 


a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 


logs, photographs, and correspondence; 


b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 


c. evidence ofthe lack of such malicious software; 


d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 


to crime under investigation and to the computer user; 


e. evidence indicating the computer user’s state of mind as it relates to the crime 


under investigation; 


f. evidence of the attachment to the COMPUTER of other storage devices or similar 


containers for electronic evidence; 


g. evidence of counter-forensic programs (and associated data) that are designed to 


eliminate data from the COMPUTER; 


h. evidence of the times the COMPUTER was used; 


i. passwords, encryption keys, and other access devices that may be necessary to 


access the COMPUTER; 


j. documentation and manuals that may be necessary to access the COMPUTER or 


to conduct a forensic examination of the COMPUTER; 


k. records of or information about Internet Protocol addresses used by the 


COMPUTER; 


l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 


records of user-typed web addresses; 


m. contextual information necessary to understand the evidence described in this 


attachment. 


4, Routers, modems, and network equipment used to connect computers to the 


Internet. 


As used above, the terms “records” and “information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 


that can store data); any handmade form (such as writing); any mechanical form (such as printing 


or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 


videotapes, motion pictures, or photocopies). 


The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 


network hardware. 


The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 


other magnetic or optical media. 


